Revision as of 16:42, 27 April 2012

Contents

(E)JTAG in general

Most of modern MIPS SOCs support JTAG (IEEE 1149.1). The MIPS EJTAG is a proprietary extension which utilizes widely used IEEE JTAG pins for debug functions. EJTAG provides: run control, single-step execution, breakpoints on both data and instructions, real-time trace (optional) and direct memory access.

The EJTAG prior v2.6 was not documented, however many SOCs still use it. The v2.6 is fully documented and available on the MIPS site (free registration required). The IMPCODE register contains EJTAGver field, so software should read it to distinguish EJTAG version.

Memory access

MIPS EJTAG has two modes, one is "DMA" mode where the JTAG can cause CPU bus cycles directly, the other "PrAcc" is where the JTAG interface is used to respond to CPU memory accesses in a special range of memory (DMSEG, 0xFF200000) and you have to write little bits of MIPS code to do what you want and emulate that memory on the host side. All systems support PrAcc mode by nature. The DMA mode is optional and not as widely supported as the normal mode. The presence of DMA mode is noted in the IMPCODE register.

DINT pin is used to raise Debug Interrupt. Many chips has no this pin.

nTRST is a "TAP Reset" signal and it's active level is "0" (the first "n" indicates negative logic). This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.

nSRST is a "system reset" signal and acts like conventional "Reset' button. Does not reset TAP controller. nSRST often resets a SoC peripherals (i.e. DRAM controller) too. nSRST is optional.

(E)JTAG Cables

There is a page at the OpenWrt Wiki that discusses JTAG cables. Specifically, how one Wiggler-style buffered cable can be used for both ADM5120-based routers (e.g. Edimax) and Broadcom-based routers (e.g. Linksys). Most of the discussion centers on difficulties that can arise when using a Wiggler-style cable with the Linksys de-brick utility, but the cable information is applicable to Edimax (ADM5120) devices as well.

The openwince jtag software can be used to re-flash, but that project is a shambles. If you dig around enough through the patches and discussions there you can find enough to make it work. The UrJTAG project (openwince fork) integrates most of this patches.

PEEDI is a hardware JTAG emulator and Flash Programmer with built-in support for GNU gdb

http://www.usbjtag.com. The new generation uses Cypress FX2 and CPLD optimized for MIPS JTAG. It runs on Win32 and have been ported to Linux too (With Mac OS support pending). It has wide range of flash support. The programming speed is lightening fast. A recent German company used it to program its Linux based router (SPI chip) and get the programming speed of 342KB/s.